Skip to main content

Hybrid systems for hybrid threats

By [email protected] - 23rd June 2017 - 14:07

Recent years have seen a dramatic change in the nature of threats encountered in defence. Widespread access to the internet through proliferating mobile devices has increasingly caused the boundaries between the cyber and physical domains to blur. This has had a profound impact on defence – NATO now argues that military confrontations are no longer purely physical but a combination of physical and cyber elements designed to spread misinformation, disrupt and pave the way for directed military action. We now live in a world of hybrid war in which all available channels are used to develop and deploy integrated military strategies.

An important vector for this new kind of hybrid warfare is social media, itself a hybrid of many different forms of data: social media posts may contain natural text, as well as hashtags that link them to particular themes, images and videos; their metadata may contain structured location information such as a geotag or an IP address. Combining this data can generate highly effective responses, showing what those is in an operational area are saying, seeing and sharing, and then placing that information in its geospatial context.

The geospatial industry has been quick to use social media data and there are now a number of systems specifically designed to analyse and geolocate social media data for defence applications. For example, social media analytics firm Sc2 Corps developed the Human Terrain Analysis System (HTAS) for use by US national security organisations and special forces. HTAS enables users to mine open source content from the web and apply sentiment, behaviour and geospatial analytics to trace the flow of social media content across cyber and physical space. This arms users with a powerful tool able to reach new areas of intelligence analysis and allows defence organisations to look beyond traditional intelligence sources, such as agents and media reports. Other dedicated social media analysis tools can monitor online conversations around locations, to detect emerging threats, or analyse the media strategy of enemy agents to inform the communications strategy of local forces.


However, these specialised geospatial analysis systems are just that – specialised. They do not fit into common operating picture (COP) applications used by those working in wider operational roles so are, in effect, siloed systems. With social and digital media a key part of modern military strategy, bespoke analysis tools do not provide the shared situational awareness necessary with hybrid warfare.

Many existing COP systems based on GIS require dedicated formats to visualise the different data needed. Defence systems take time to be developed and implemented, and most existing military geospatial systems were created more than a decade ago. This means they were not developed to analyse social media or extract its geospatial elements.

Many COP systems also help to locate and visualise different physical assets, communicating precise coordinates and calculating routes; these do not take into account the more nuanced task of analysing the data generated by Tweets, for example. Even if existing systems can analyse social media, many geodatabases find it daunting to do so in real-time.

Anyone needing to pinpoint the effect of information shared on social channels and work out the geographic spread of that information must currently use a variety of systems. If new types of media emerge, new systems will be needed to analyse them. This presents two related risks: specialists become overloaded with a proliferation of geospatial systems; and solutions to new problems take too long to be developed.

Adapt to survive

To address this issue, we must adapt existing systems so that they can cope with the evolving landscape and provide a comprehensive COP. This means that systems must be developed with a focus on open standards and an API that enables end users to integrate new types of geospatial data.

Furthermore, developers must usefully integrate the data into the COP. For example, they can geofence major urban areas, scouring unstructured Tweet data for nefarious terms and raising red flags for analysts. Similarly, word cloud tools and timeline features can help analysts identify how conversations evolve over time. The ultimate benefit of this is that the data does not exist in a vacuum, so analysts can identify potential threats and immediately use the COP system to coordinate operations.

Flexible COP systems do already exist, including many of NATO’s C2, C3 and C4ISR systems, such as the ICC (Integrated Command and Control) and iGeoSIT (interim Geospatial Intelligence Tool). This has allowed it to respond quickly to changing needs – when it needed to develop a situational awareness application capable of combining data from all military domains, it could combine components from existing systems to quickly create the Interim Joint Common Operational Picture (JCOP).

The same process can be applied to integrating geospatial data from the social domain into existing systems. Existing situational awareness systems, such as JCOP and its successor NCOP (NATO Common Operation Picture), could be extended with software components designed to extract and analyse social media data, integrating the capability of bespoke geospatial social media analysis tools into existing systems.


Integrating social media data into geospatial command and control systems in this way has the potential to counter some of the key threats presented by hybrid war. It would allow operational staff at all levels to cross-reference the spread of information through social media channels with other forms of intelligence already integrated into existing systems.

For example, the spread of misinformation could be correlated with reports of civil disruption caused by this misinformation, which would allow commanders to formulate a strategy informed by the specific causes of that disruption. It would also allow for the rapid assessment of physical assets in areas affected by hostile action taken through digital channels, allowing for quick decision making to respond to threats as they emerge.

This doesn’t mean that the work of analysts using specialist tools would no longer have value. Instead, it would be used to inform future operations, real-time geospatial data being used to respond to developing situations.

By developing systems used by all those working in the field flexibly, hybrid systems capable of tackling the emerging threat of a cyber-physical hybrid war can be deployed and used to rapidly respond to this new form of war.

Marc Melviez is CEO of Luciad


Download a PDF of this article